Yes indeed its a little crazy :-) As anthony mentioned if libvirt were
able to be notified of changes a user makes in the monitor, there's no
reason we could not allow end users to access the monitor of a VM
libvirt is managing. We just need to make sure libvirt doesn't miss

changes like attaching or detaching block devices, etc, because that'll
cause crash/data loss later when libvirt migrates or does save/restore,
etc because it'll launch QEMU with wrong args

You still have an inherent race here.
user: plug in disk
libvirt: start migration, still without disk
qemu: libvirt, a disk has been plugged in.

That is true, but we'd still be considering direct monitor access to
be a 'expert' user mode of use. If they wish to shoot themselves in
the foot by triggering a migration at same time they are hotplugging

I'm fine if their whole leg gets blown away.

What if the system triggers migration automatically (as you'd expect).

And that's just one example. I'm sure there are more. libvirt issues
commands expecting some state in qemu. It can't learn of that state from
listening on another monitor, because there are delays between the state
changing and the notification.

If you want things to work reliably, you have to follow the chain of
command.

--
I have a truly marvellous patch that fixes the bug which this
signature is too narrow to contain.